From ad06910687496e0951832d9965d41b4280e466b3 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Tue, 28 Oct 2025 15:37:39 +0100 Subject: [PATCH] security/acme-client: use mwexec/file_safe Although technically we shouldn't from classes inside MVC but it is what it is. PR: https://github.com/opnsense/core/issues/9325 --- security/acme-client/Makefile | 1 + .../AcmeClient/LeValidation/HttpOpnsense.php | 13 ++++++------- .../AcmeClient/LeValidation/TlsalpnAcme.php | 13 ++++++------- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/security/acme-client/Makefile b/security/acme-client/Makefile index a81e74fb7..711735a66 100644 --- a/security/acme-client/Makefile +++ b/security/acme-client/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= acme-client PLUGIN_VERSION= 4.10 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= ACME Client PLUGIN_MAINTAINER= opnsense@moov.de PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php index 12ab4ba56..8670eb96c 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/HttpOpnsense.php @@ -126,18 +126,17 @@ class HttpOpnsense extends Base implements LeValidationInterface // Create temporary port forward to allow acme challenges to get through $anchor_setup = "rdr-anchor \"acme-client\"\n"; - file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup); - chmod("{$configdir}/acme_anchor_setup", 0600); - mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup"); - file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules); - chmod("{$configdir}/acme_anchor_rules", 0600); - mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules"); + // XXX Should not be using util.inc from here + file_safe("{$configdir}/acme_anchor_setup", $anchor_setup, 0600); + mwexecf('/sbin/pfctl -f %s', ["{$configdir}/acme_anchor_setup"]); + file_safe("{$configdir}/acme_anchor_rules", $anchor_rules, 0600); + mwexecf('/sbin/pfctl -a %s -f %s', ['acme-client', "{$configdir}/acme_anchor_rules"]); } public function cleanup() { // Flush OPNsense port forward rules. - mwexec('/sbin/pfctl -a acme-client -F all'); + mwexecf('/sbin/pfctl -a %s -F %s', ['acme-client', 'all']); // Workaround to solve disconnection issues reported by some users. $backend = new \OPNsense\Core\Backend(); diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php index 03a4f9d76..068adc823 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/TlsalpnAcme.php @@ -127,18 +127,17 @@ class TlsalpnAcme extends Base implements LeValidationInterface // Create temporary port forward to allow acme challenges to get through $anchor_setup = "rdr-anchor \"acme-client\"\n"; - file_put_contents("{$configdir}/acme_anchor_setup", $anchor_setup); - chmod("{$configdir}/acme_anchor_setup", 0600); - mwexec("/sbin/pfctl -f {$configdir}/acme_anchor_setup"); - file_put_contents("{$configdir}/acme_anchor_rules", $anchor_rules); - chmod("{$configdir}/acme_anchor_rules", 0600); - mwexec("/sbin/pfctl -a acme-client -f {$configdir}/acme_anchor_rules"); + // XXX Should not be using util.inc from here + file_safe("{$configdir}/acme_anchor_setup", $anchor_setup, 0600); + mwexecf('/sbin/pfctl -f %s', ["{$configdir}/acme_anchor_setup"]); + file_safe("{$configdir}/acme_anchor_rules", $anchor_rules, 0600); + mwexecf("/sbin/pfctl -a %s -f %s", ['acme-client', "{$configdir}/acme_anchor_rules"]); } public function cleanup() { // Flush OPNsense port forward rules. - mwexec('/sbin/pfctl -a acme-client -F all'); + mwexecf('/sbin/pfctl -a %s -F %s', ['acme-client', 'all']); // Workaround to solve disconnection issues reported by some users. $backend = new \OPNsense\Core\Backend();